Gentoo Logo
Gentoo Spaceship




Note: Due to technical difficulties, the Archives are currently not up to date. GMANE provides an alternative service for most mailing lists.
c.f. bug 424647
List Archive: gentoo-dev
Navigation:
Lists: gentoo-dev: < Prev By Thread Next > < Prev By Date Next >
Headers:
To: gentoo-dev@g.o
From: "Robin H. Johnson" <robbat2@g.o>
Subject: Re: integrity of stage files
Date: Sun, 9 Oct 2011 00:01:58 +0000
On Sat, Oct 08, 2011 at 04:39:40PM -0700, "Paweł Hajdan, Jr." wrote:
> On 10/8/11 3:43 PM, Robin H. Johnson wrote:
> >> 1. Why are we using _only_ MD5 and SHA1 as the checksums? Shouldn't we
> >> be using something stronger?
> > Fixed in Catalyst now.
> > http://git.overlays.gentoo.org/gitweb/?p=proj/catalyst.git;a=commit;h=42b4f6608682cf03954918ecce7923330a1656fe
> > So when the stagebuilders update their Catalyst, they will be generated
> > with newer hashes.
> 
> Thank you for a quick reaction, but maybe in one aspect it was too
> quick:
> <http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=1&chap=5>
> tells people to use md5sum, and the patch above _removes_ md5 sum, which
> means the Handbook instructions now won't work.
> 
> Suggested course of action:
> 
> 1. Please re-add md5 sum.
Done.
> 2. File a bug to modify the handbook to verify sha sum instead.
https://bugs.gentoo.org/show_bug.cgi?id=386475

> 3. Then remove the checksum.
> 
> >> 2. I noticed the checksums are signed (.asc files). With what key are
> >> they signed? How is that key handled, and how to ensure people use the
> >> right key when verifying the signature?
> > Documented here:
> > http://www.gentoo.org/proj/en/releng/
> Ah, I just forgot about that page. Okay, so can we also update the
> Handbook to include GPG signature checking?
It DOES already mention checking the signature:
http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=1&chap=2#doc_chap3

Also opened another bug for correcting keys.
https://bugs.gentoo.org/show_bug.cgi?id=386477

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Trustee & Infrastructure Lead
E-Mail     : robbat2@g.o
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85


Replies:
Re: integrity of stage files
-- Paweł Hajdan, Jr.
References:
integrity of stage files
-- Paweł Hajdan, Jr.
Re: integrity of stage files
-- Robin H. Johnson
Re: integrity of stage files
-- Paweł Hajdan, Jr.
Navigation:
Lists: gentoo-dev: < Prev By Thread Next > < Prev By Date Next >
Previous by thread:
Re: integrity of stage files
Next by thread:
Re: integrity of stage files
Previous by date:
Re: integrity of stage files
Next by date:
Re: GCC upgrades, FUD and gentoo documentation


Updated Jun 29, 2012

Summary: Archive of the gentoo-dev mailing list.

Donate to support our development efforts.

Copyright 2001-2013 Gentoo Foundation, Inc. Questions, Comments? Contact us.